php-logging-audit
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a document providing specific instructions for a security audit task. It focuses on identifying vulnerabilities in PHP logging practices, such as CRLF injection and exposure of credentials in logs. It does not initiate unauthorized network connections, execute remote code, or bypass safety filters.
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and analyze untrusted external data in the form of PHP source code, which represents an attack surface for indirect prompt injection.
- Ingestion points: The execution involves reading and parsing PHP source files and configuration files from the project being audited.
- Boundary markers: The skill does not explicitly define markers (like XML tags or specific delimiters) to differentiate between its instructions and the file content it analyzes, nor does it contain explicit warnings for the agent to ignore instructions embedded in the source code comments of the analyzed project.
- Capability inventory: The skill's capabilities are limited to file system read access for analysis and writing a Markdown report to a specific output path. No network access or arbitrary command execution capabilities are requested or used.
- Sanitization: The instructions do not specify sanitization or escaping mechanisms for the data retrieved from the PHP files before it is processed or included in the audit report.
- Note: As the skill limits operations to local file processing and reporting, and the instructions are highly specific about the required evidence and format, the risk associated with this surface is considered low.
Audit Metadata